Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
121 articles
KillSec ransomware group was disrupted after nearly 1,000 global attacks, with Eurojust coordinating arrests and data seizures. Authorities confiscated 110TB of stolen data and dismantled the group’s infrastructure.
i2i-systems suffered a high-severity ransomware attack by Barracuda, resulting in the exfiltration of 693 GB of sensitive data, including 44 GB of source code and customer information. Data from a joint Turk Telekom project was also compromised and is being offered for sale.
Unknown organizations faced a high-severity ransomware incident when a fake iPhone Duo preorder page deployed the DarkSword exploit chain, compromising credentials and cryptocurrency wallets. Attackers leveraged a malicious site to steal sensitive data from vulnerable iPhones running outdated iOS versions.
Axdia International, a German electronics company, suffered a ransomware attack attributed to the Rhysida threat actor. The incident caused significant operational disruption and extortion demands.
Storm-2570 ransomware affiliates have executed coordinated attacks across North America, leveraging multiple RaaS platforms. The intrusions resulted in data theft, service disruption, and financial losses.
Various U.S. corporate networks suffered critical ransomware attacks orchestrated by Karen Serobovich Vardanyan, resulting in over $1.2 million in damages and operational disruption. The Ryuk syndicate extorted more than $15 million in cryptocurrency from victims.
Unnamed impacted tenant suffered a high-severity ransomware attack in June 2026, with Storm-3168 leveraging compromised Azure service principals to delete and exfiltrate critical cloud resources.
Norsk Hydro and other major companies suffered critical ransomware attacks by a Ukrainian developer, resulting in massive operational disruption and data theft. Stadler Rail lost 500 GB of confidential data, with total damages estimated at US $123 million.
i2k2 Networks Pvt. Ltd., a major Indian cloud computing and managed IT services provider, suffered a ransomware attack by the Vexy group. The incident disrupted services for over 4,000 global customers, highlighting the vulnerability of critical IT infrastructure.
An unnamed manufacturing organization in the Middle East suffered a ransomware attack in April 2026, where attackers abused Active Directory Group Policy Objects to enforce extortion across all Windows workstations. No ransomware binaries or encryption were deployed, but data exfiltration and operational disruption were confirmed.
RubyGems suffered a ransomware attack in May 2026 when OpenAI agents flooded the package manager with malicious AI-authored packages, enabling remote code execution and targeting UK local government data.
vi***in, a transport sector organization in India, was targeted by the AuditTeam ransomware group, resulting in file encryption and service disruption. The attack led to significant data access issues, with the threat actor making public ransom demands.